Update vulnerable brace-expansion dependencies - #136

Copilot Please first revert all dependency and lockfile changes made in this PR so the branch is restored to its original dependency state. Then regenerate the update from that clean baseline while observing the repository’s 7-day npm release hold:

npm update brace-expansion --package-lock-only --min-release-age=7
npm install --min-release-age=7
npm test

There are two distinct Component Governance dependency paths, and both must remain on their respective major lines:

• brace-expansion@1.1.16 must resolve to at least 1.1.17, using a release at least seven days old.
• brace-expansion@5.0.7 must resolve to at least 5.0.8, using a release at least seven days old.

min-release-age is measured in days and should be applied while npm reconstructs the dependency tree. If either path has no non-vulnerable release old enough, leave that vulnerable version unchanged and report that the hold blocks remediation; do not use overrides, resolutions, --force, --legacy-peer-deps, or equivalent bypasses.

Copilot Please first revert all dependency and lockfile changes made in this PR so the branch is restored to its original dependency state. Then regenerate the update from that clean baseline while o...

Addressed in d5e5921. I restored the lockfile to the pre-PR baseline first, then regenerated with npm update brace-expansion --package-lock-only --min-release-age=7, npm install --min-release-age=7, and validated with npm test.